CVE-2016-3088criticalunder attackCWE-434

CVE-2016-3088

Published · Updated

Follow this CVE+ Monitor Apache ActiveMQ+ Monitor activemq

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 99%
from disclosure to weaponsame day
Published on NVDJun 1
1st PoCAug 17
metasploitJun 1
CISA KEV+2080d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
2 products
Red Hat JBoss A-MQ 6 · Red Hat JBoss Fuse 6
workaround: Users are advised to use other FTP and HTTP based file servers for transferring blob messages. Fileserver web application SHOULD NOT be used in older version of the broker and it should be disabled (it has been disabled by default since 5.12.0)…
Fixed
2 products
Red Hat JBoss A-MQ 6.3 · Red Hat JBoss Fuse 6.2
fix ↗
Not affected
2 products — because the vulnerable code is not present in the product
Red Hat JBoss Fuse Service Works 6 · Red Hat OpenShift Enterprise 2
Action required by CISAfederal deadline: 2022-08-10

Apply updates per vendor instructions.

In short

Apache ActiveMQ's file server allows attackers to upload harmful files to the server through HTTP requests and then execute them, potentially taking complete control of the system.

Technical detail

The vulnerability exists in ActiveMQ 5.x versions before 5.14.0 where the Fileserver web application fails to properly validate file uploads. An attacker can upload arbitrary files via HTTP PUT requests and subsequently move them to executable locations using HTTP MOVE requests, achieving remote code execution without authentication.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.